An Internet connected business server typically has a login process for verifying the identity of a user attempting to connect to the server (e.g., utilizing a username and password). An attacker attempting to break into the business server can make a brute force attack on the login process by submitting different passwords for a username known to be valid, until the correct password is submitted and the attacker is granted access. One known brute force attack prevention system is the CAPTCHA (e.g., completely automated public Turing test to tell computers and humans apart), wherein a user is required to enter the text shown in an image presented in a login screen. The text shown in the image is purposefully distorted to make it difficult to identify for a computer executing a brute force attack. However, as computer power grows, the time needed for a computer to identify a CAPTCHA shrinks, making it less of a barrier to a brute force attack. Use of a CAPTCHA is additionally unpopular with users. Another known brute force attack prevention system is the use of a lockout after a certain number of incorrect password attempts. After a predetermined number of incorrect password attempts associated with a username (e.g., within a given period of time), no more password attempts are accepted. Password attempts are accepted again after a lockout delay (e.g., 5 minutes, 24 hours, etc.) or after a manual reset (e.g., the user calls customer service). A lockout does not stop an attacker because the attacker can make password attempts for successive usernames until being locked out of each username. Using this method, an attacker can lock out a large fraction of the server users, effectively shutting the server down by preventing a large number of users from logging in.